jChains
nEws
- 09.04.04 - jChains sources added
Get the Sources from the official jchains source codedirectory !
- 29.01.04 - jChains has a GUI now (see screenshots below)
dEscription
This custom security manager framework records the permissions needed for the codebases (jars) of j2se applications running under access control
of a security manager. The resulting policy file is recorded while running the program and is useful as a starting point when developing a security policy for a java application. When run against libraries when source is not available it is useful for reverse engineering, revealing the permission needed to use the libraries. This is helpful when you do not trust the jar , and do not want to grant it the AllPermission free ride ticket.

fIles
In order to get familiar with the classes, please spend a look for the javadoc-files. An initial release can be found in the following ia.zip file,source code will be released when code cleanup is completed.
sAmples
- This link provides a sample output of jchains when running against jedit 4.1.
- This link provides a sample output of jchains when running against jboss3.2.1 (first 64k)
uSage
- In order to use jchains you first need to setup a CORBA orb infrastructure, so start the ORB demon with orbd
orbd -ORBInitialPort 1050 -serverPollingTime 200
- Then register the CORBA receiver in the persistent CORBA server manager servertool
servertool -ORBInitialPort 1050
- Inside servertool register the receiver with
register -server org.illegalaccess.jchains.receiver.Receiver -applicationName PermissionTransfer -classpath ia.zip
Now you have setup the receiver, now you start the application from which you want to squeeze out the needed permission
- Basically you just need to put the ia.zip in the classpath and set the following environment variables
- -Dorg.illegalaccess.emitClass=org.illegalaccess.jchains.intercept.CORBAEmitter
- -Dorg.illegalaccess.jchains.outputfile=jbossout.txt
- -Dorg.illegalaccess.jchains.CNameServiceIOR=corbaloc::localhost:1050/NameService
- -Djava.security.manager=org.illegalaccess.jchains.intercept.JChainsSecInterceptor
- This file is the startup file I used to retrieve the needed permissions for jboss 3.2.1
sCreenshots

The Execution Environment

The Status Dashboard

The Permission Request Logs

The Policy File
mOre iNformation
For more information please contact me at marc(at)marc-schoenefeld.de
lInks oN jAva sEcurity
cOverage
sUpport